let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  NATS = {
    name         | String,
    version      | String,
    port         | Number | default = 4222,
    monitor_port | Number | default = 8222,
    data_dir     | String | default = "/data",
    mode         | [| 'taskserv, 'cluster, 'container |] | default = 'cluster,

    namespace     | String | optional,
    image         | String | optional,
    storage_class | String | optional,

    jetstream | {
      max_mem  | String | default = "256MB",
      max_file | String | default = "1GB",
    } | default = {},

    # NKey-based authorization (single user; back-compat). When enabled = true,
    # the broker accepts NKey-authenticated clients in addition to user/password.
    # Public NKey is read from the env var $NATS_NKEY_PUB at config-load time.
    # Prefer `nkey_users` (multi-user, per-account subject scoping) for new deployments.
    nkey | {
      enabled          | Bool         | default = false,
      allow_publish    | Array String | default = [],
      allow_subscribe  | Array String | default = ["_INBOX.>"],
    } | default = {},

    # Multi-user NKey authorization. When non-empty, this list replaces the
    # single-user `nkey` block above. Each entry registers an independent
    # NATS account with its own pubkey + subject scope, providing real
    # isolation between consumers (the daemon, the agent, each tenant
    # workspace). The broker reads each pubkey from `$NATS_${PUB_ENV_VAR}_PUB`
    # at config-load time — operator-side credential delivery materialises
    # one Secret data field per user (uppercased name + `_PUB` suffix).
    #
    # Each user MUST include `_INBOX.>` in BOTH allow_publish AND
    # allow_subscribe — required for NATS request/reply patterns.
    nkey_users | Array {
      name             | String,
      pub_env_var      | String,
      allow_publish    | Array String,
      allow_subscribe  | Array String,
    } | default = [],

    requires | {
      storage | { size | String, persistent | Bool } | optional,
      ports   | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service  | String | optional,
      port     | Number | optional,
      protocol | String | optional,
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = false,
      delete  | Bool | default = false,
      backup  | Bool | default = false,
      restore | Bool | default = false,
      health  | Bool | default = false,
      restart | Bool | default = false,
    } | default = {},

    # ServiceConcerns umbrella (ADR-008). NATS/JetStream message bus.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}